{"id":"ASB-A-481967442", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-12T15:08:17.296522730Z", "aliases":["CVE-2026-28580", "A-481967442"], "details":"In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["165244540637924401557640048652757763552", "257736362510135360840653774735413042773", "146129595386038721990984551099174763672", "301952237391073482720007218921354080867", "71573022188803360753771561952034869011", "180106432130842263329597154305917452391", "293322401576095725964532517829214158258", "70810745183744949730094622808483430570", "254115555012421027529185926390220626317", "269491136932058675794174344396066394850", "309289096885961521629619510083029120887", "292278566044345597001780785120999711724", "217205556303982368805246957501137554399", "196145488914074019479235612975070765329", "328477181358208825362340145259055900041", "73185503361627566878888113404923428856", "274188296471766135728195273722346189842", "95351127904209469975589963375414970799", "19199824950961330517172029516460358297", "249446470169117098854071570937439734209", "334258895799137905571381332014549593781", "285602280981664444887378475610782202957", "306217516614748796354486466595327591516"], "threshold":0.9}, "id":"ASB-A-481967442-09c20e11", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74", "target":{"file":"core/java/android/app/NotificationChannel.java"}}, {"deprecated":false, "digest":{"function_hash":"155213422576754290882979249616505399927", "length":3230}, "id":"ASB-A-481967442-1a27b79d", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74", "target":{"file":"core/java/android/app/NotificationChannel.java", "function":"writeXml"}}, {"deprecated":false, "digest":{"function_hash":"113549265958199584957255370883724330134", "length":2318}, "id":"ASB-A-481967442-afab5f20", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74", "target":{"file":"core/java/android/app/NotificationChannel.java", "function":"NotificationChannel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["165244540637924401557640048652757763552", "257736362510135360840653774735413042773", "146129595386038721990984551099174763672", "301952237391073482720007218921354080867", "285977560234934879242928721504139102656", "162828736071881943805412918618395286789", "201931975452051844076884988539719402272", "91219096265341906845114753537600964678", "199086461619023026386381680070065194960", "150742741839475808745571907907247092208", "88408364532948866847194171120372312692", "321044452669203509211491873396981695059", "104805565460518931961332532419712441685", "87414709181241507161833155175896337759", "50324501231826789160309840540062699582", "237600475723482905836895182920741024271", "234484405130511569076714754633179401773", "105427670492930361006516195268957660731", "143229091783369377950465180588257894375", "58406200006327456834217382734249525956", "159047662255772916035361968244877418016", "35180091316272223097213034150472977047", "196145488914074019479235612975070765329", "328477181358208825362340145259055900041", "73185503361627566878888113404923428856", "161837083178008026165667893933912241392", "140291662063997200928946091320824199391", "319998436516802551091498088607948292344", "21610776523271579580951516579849670828", "334258895799137905571381332014549593781", "285602280981664444887378475610782202957", "306217516614748796354486466595327591516"], "threshold":0.9}, "id":"ASB-A-481967442-30a44a1e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741", "target":{"file":"core/java/android/app/NotificationChannel.java"}}, {"deprecated":false, "digest":{"function_hash":"259308048496297022908965593157989218270", "length":2957}, "id":"ASB-A-481967442-ba9338f3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741", "target":{"file":"core/java/android/app/NotificationChannel.java", "function":"writeXml"}}, {"deprecated":false, "digest":{"function_hash":"190092132057378496538523398227059698467", "length":2251}, "id":"ASB-A-481967442-ff59c97e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741", "target":{"file":"core/java/android/app/NotificationChannel.java", "function":"NotificationChannel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["165244540637924401557640048652757763552", "257736362510135360840653774735413042773", "146129595386038721990984551099174763672", "301952237391073482720007218921354080867", "71573022188803360753771561952034869011", "180106432130842263329597154305917452391", "293322401576095725964532517829214158258", "70810745183744949730094622808483430570", "254115555012421027529185926390220626317", "269491136932058675794174344396066394850", "309289096885961521629619510083029120887", "292278566044345597001780785120999711724", "23558343870398825914313614032097122443", "196145488914074019479235612975070765329", "328477181358208825362340145259055900041", "73185503361627566878888113404923428856", "274188296471766135728195273722346189842", "95351127904209469975589963375414970799", "19199824950961330517172029516460358297", "249446470169117098854071570937439734209", "334258895799137905571381332014549593781", "285602280981664444887378475610782202957", "306217516614748796354486466595327591516"], "threshold":0.9}, "id":"ASB-A-481967442-2121666b", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f", "target":{"file":"core/java/android/app/NotificationChannel.java"}}, {"deprecated":false, "digest":{"function_hash":"20873914928737980341056725662531984103", "length":2923}, "id":"ASB-A-481967442-6f6a6ef4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f", "target":{"file":"core/java/android/app/NotificationChannel.java", "function":"writeXml"}}, {"deprecated":false, "digest":{"function_hash":"261744550140028090282411973553245923566", "length":2081}, "id":"ASB-A-481967442-cb225e69", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f", "target":{"file":"core/java/android/app/NotificationChannel.java", "function":"NotificationChannel"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/80828212c3187adf56fc2a25d2d24001c5209937"}]}